During its latest plenary, the European Data Protection Board (EDPB) issued its highly anticipated opinion following a request by the Dutch, Norwegian & Hamburg Data Protection Authorities (DPAs). The opinion addresses the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms.
By way of background, Meta has used “consent” under Article 6(1)(a) GDPR as the legal basis for processing users’ personal data, for example for advertising. Under the GDPR, consent would have to be specific, informed, unambiguous and freely given. Meta was concerned that giving users such a yes or no option would limit their options. As such, Meta argued that it was part of the user contract to show ads, using Article 6(1)(b) GDPR. This was ruled unlawful by the Court of Justice of the European Union (CJEU) and the EDPB in 2023. Meta then implemented the ‘pay or consent’ model by asking users to consent or pay a fee to access its platforms.
The EDPB was asked to issue its opinion under Article 64(2) GDPR to address the validity of consent in the context of ‘consent or pay’ models also in view of the Court of Justice of the European Union’s Bundeskartellamt judgment (C-252/21). The DPAs originally referred the ‘pay or consent’ question to the EDPB in January 2024. The DPAs sought EDPB clarity on the matter after Meta first sought to implement the model for its Facebook and Instagram platforms after the body issued a binding ruling in November 2023 banning Meta’s targeted advertising practices across the EEA, which was preceded by a €390 million fine issued to Meta by Ireland’s DPC over its targeted advertising practices earlier last year.
In its press release on the opinion, the EDPB stated that, “In most cases, it will not be possible for (large online platforms) to comply with the requirements for valid consent, if they confront users only with a choice between consenting to processing of personal data for behavioural advertising purposes or paying a fee.” The EDPB opinion applies to companies designated as very large online platforms under the Digital Services Act. However, the EDPB said it would issue further guidance later this year on pay or consent for smaller platforms.
The decision is non-binding and either Ireland’s Data Protection Commission will apply the opinion or the DPAs that referred the matter to the EDPB will issue their final decision on the legality of ‘pay or consent’ models in the context of the GDPR as they further investigate Meta, which had first sought to implement such a model.
The EDPB’s opinion means that controllers relying on consent need to evaluate the imbalance of power between the individual and the controller and confirm if it is in fact freely given. The factors to be assessed include the position of the very large online platforms in the market, the extent to which the individual relies on the service and the main audience of the service.
If you would like to keep up to date on the latest in data protection, please get in touch to subscribe to our newsletter, The Data Download.
Link to the EDPB’s opinion: https://www.edpb.europa.eu/news/news/2024/edpb-consent-or-pay-models-should-offer-real-choice_en
